1.Rule Title : Tainted Inputs: $_REQUEST

---

Rule Description : Detects the usage of the $_REQUEST superglobal, which can introduce tainted inputs into the code.

Issue Description : If this rule matches, it indicates the potential vulnerability of using user input from the $_REQUEST superglobal without proper validation and sanitization. Attackers can manipulate request parameters to provide malicious or unexpected values, potentially leading to security vulnerabilities such as injection attacks (SQL, OS, or LDAP), cross-site scripting (XSS), or remote code execution.

Developer Note : Developers should validate and sanitize user input received from the $_REQUEST superglobal before using it in any sensitive operations. They should implement strong input validation, ensuring that only expected and sanitized values are accepted from requests. Additionally, developers should be cautious about the potential risks associated with using user-supplied data and follow secure coding practices, such as parameterized queries, output encoding, and appropriate input filtering techniques, depending on the context in which the input is used.

Reviewer Note : Reviewers should ensure that proper input handling is in place for the $_REQUEST superglobal. They should verify that developers have implemented appropriate input validation and sanitization techniques to prevent security vulnerabilities related to tainted inputs. Reviewers should also assess the sensitivity of the data handled through requests and confirm that relevant security measures, such as output encoding and protection against injection attacks, are implemented correctly.

---

2.Rule Title : Tainted Inputs: $_GET

---

Rule Description : Identifies the usage of the $_GET superglobal, which may lead to tainted inputs being used in the code.

Issue Description : If this rule matches, it indicates the potential vulnerability of using user input from the $_GET superglobal without proper validation and sanitization. Attackers can manipulate URL parameters to provide malicious or unexpected values, potentially leading to security vulnerabilities such as injection attacks (SQL, OS, or LDAP), cross-site scripting (XSS), or unauthorized access to sensitive information.

Developer Note : Developers should carefully validate and sanitize user input received from the $_GET superglobal before using it in any sensitive operations. They should implement strong input validation, ensuring that only expected and sanitized values are accepted from URL parameters. Additionally, developers should be aware of the risks associated with using user-supplied data and follow secure coding practices, such as parameterized queries, output encoding, and appropriate input filtering techniques, depending on the context in which the input is used.

Reviewer Note : Reviewers should check for appropriate input handling for the $_GET superglobal. They should assess if developers have implemented proper input validation and sanitization techniques to prevent security vulnerabilities related to tainted inputs. Reviewers should also verify the usage of output encoding and protection against injection attacks to ensure the secure handling of user input received through URL parameters.

---

3.Rule Title : Tainted Inputs: $_COOKIE

---

Rule Description : Detects the usage of the $_COOKIE superglobal, which can introduce tainted inputs into the code.

Issue Description : If this rule matches, it indicates the potential vulnerability of using user input from the $_COOKIE superglobal without proper validation and sanitization. Attackers can manipulate cookies to provide malicious or unexpected values, potentially leading to security vulnerabilities such as session hijacking, privilege escalation, or information disclosure.

Developer Note : Developers should validate and sanitize user input received from the $_COOKIE superglobal before using it in any sensitive operations. They should implement strong input validation, ensuring that only expected and sanitized values are accepted from cookies. Additionally, developers should be cautious about the potential risks associated with using cookies for sensitive data or session management and follow secure coding practices and guidelines.

Reviewer Note : Reviewers should ensure that proper input handling is in place for the $_COOKIE superglobal. They should verify that developers have implemented appropriate input validation and sanitization techniques to prevent security vulnerabilities related to tainted inputs. Reviewers should also assess the sensitivity of the data handled through cookies and confirm that relevant security measures, such as secure session management, are implemented correctly.

---

4.Rule Title : Command Injection: shell_exec|exec|passthru|system|popen|backtick

---

Rule Description : Detects instances of shell-executing functions that can lead to command injection vulnerabilities if used with user-supplied input.

Issue Description : If this rule matches, it indicates the potential vulnerability of command injection. Attackers can exploit shell-executing functions with unsanitized user input to execute arbitrary shell commands on the server. This can lead to unauthorized access, data loss, remote code execution, or other malicious activities depending on the context in which the commands are executed.

Developer Note : Developers should avoid using shell-executing functions with user-supplied input whenever possible. If their usage is necessary, it is crucial to employ strict input validation, input sanitization, and command parameterization techniques to prevent command injection attacks. Developers should also consider using safer alternatives, such as APIs with built-in security features or language constructs that mitigate command execution risks.

Reviewer Note : Reviewers should check for the secure usage of shell-executing functions and assess if user input is properly validated, sanitized, and appropriately used as command parameters. They should ensure that developers have implemented strong input validation measures, command parameterization techniques, and proper context-aware security controls to mitigate command injection vulnerabilities. Reviewers should also validate if safe alternatives or language constructs have been considered to minimize the risks associated with shell command execution.

---

5.Rule Title : Arbitrary Code Execution: eval|exec

---

Rule Description : Detects the usage of eval() and exec() functions, which can lead to arbitrary code execution vulnerabilities.

Issue Description : If this rule matches, it indicates the potential vulnerability of code injection. Attackers can exploit these functions to execute arbitrary code, potentially gaining unauthorized access, compromising data integrity, or executing malicious actions on the server.

Developer Note : Developers should avoid using eval() and exec() functions whenever possible. If their usage is unavoidable, it is crucial to validate and sanitize any user-supplied input before passing it to these functions. Developers should explore safer alternatives or restrict the execution to a limited and controlled environment.

Reviewer Note : Reviewers should identify the presence of eval() and exec() functions and assess if user input is directly passed to these functions. They should verify that proper input validation and sanitization are applied to mitigate the risk of arbitrary code execution vulnerabilities. Additionally, reviewers should encourage the use of safer alternatives and evaluate the execution context to minimize potential harm.

---

6.Rule Title : Insecure Method Call: header()

---

Rule Description : Detects insecure usage of the header() function, specifically related to the "Location" parameter.

Issue Description : If this rule matches, it indicates the potential vulnerability of insecure header redirection. Attackers can manipulate the "Location" parameter in header() calls to redirect users to malicious websites or perform phishing attacks.

Developer Note : Developers should ensure that any user input used in the "Location" parameter of header() calls is properly validated, sanitized, and restricted to trusted values. They should also consider using security libraries or frameworks that provide safer methods for handling redirects.

Reviewer Note : Reviewers should identify the usage of header() with the "Location" parameter and verify that input validation and sanitization are applied to prevent header injection vulnerabilities. They should also check if a secure redirect mechanism is used to mitigate the risk of unauthorized redirects.

---

7.Rule Title : Insecure Method Call: include() and require()

---

Rule Description : Detects insecure usage of the include() and require() functions, particularly when loading files based on user input.

Issue Description : If this rule matches, it indicates the potential vulnerability of file inclusion attacks. Attackers can manipulate user-supplied input to include arbitrary files, leading to unauthorized access, code execution, or sensitive information disclosure.

Developer Note : Developers should avoid using user input directly in the path of include() and require() statements. They should carefully validate and sanitize any user input before incorporating it into file inclusion operations. Additionally, developers should consider using whitelisting or safe alternatives to dynamically include files.

Reviewer Note : Reviewers should identify the presence of include() and require() functions and check if user input is used in the file path. They should verify that proper input validation and sanitization are implemented to mitigate the risk of file inclusion vulnerabilities. Additionally, reviewers should confirm the usage of secure coding practices such as whitelisting or safe alternatives for dynamic file inclusion.

---

8.Rule Title : Insecure Method Call: extract()

---

Rule Description : Detects insecure usage of the extract() function, which can introduce security vulnerabilities.

Issue Description : If this rule matches, it indicates the potential vulnerability of variable overwrite or injection. Attackers can manipulate the extracted variables and introduce unexpected behavior, overwrite existing variables, or introduce new variables with unintended values.

Developer Note : Developers should avoid using the extract() function, especially with user-supplied arrays as the first parameter. Instead, they should access array elements explicitly and validate/sanitize user input before incorporating it into variable assignments.

Reviewer Note : Reviewers should identify the presence of the extract() function and ensure that it is not used with user-supplied arrays. They should also verify that input validation and sanitization are performed before assigning values to variables to prevent security vulnerabilities arising from variable overwrite or injection.

---

9.Rule Title : Object Injection via Serialization

---

Rule Description : Detects the usage of unserialize() or serialize() functions, which can introduce object injection vulnerabilities if not properly validated.

Issue Description : If this rule matches, it indicates the potential vulnerability of object injection. Attackers can exploit insecure deserialization by manipulating serialized data to execute arbitrary code, escalate privileges, or perform other malicious actions.

Developer Note : Developers should be cautious when using unserialize() or serialize() functions and ensure that any serialized data is properly validated and comes from a trusted source. Implementing secure deserialization practices and input validation can help mitigate object injection vulnerabilities.

Reviewer Note : Reviewers should examine the implementation of unserialize() or serialize() functions to verify the presence of secure deserialization practices. They should also ensure that the serialized data is properly validated and comes from a trusted source, and that the codebase follows secure coding guidelines to prevent object injection vulnerabilities.

---

10.Rule Title : Cross-Site Scripting (XSS) via PHP_SELF

---

Rule Description : Detects the usage of the PHP_SELF variable in the context of cross-site scripting (XSS) vulnerabilities.

Issue Description : If this rule matches, it indicates the potential vulnerability of cross-site scripting (XSS). Attackers can exploit the PHP_SELF variable to inject malicious scripts into web pages and potentially steal sensitive user information or perform unauthorized actions on behalf of the user.

Developer Note : Developers should avoid directly using the PHP_SELF variable to generate URLs or include it in output without proper sanitization and encoding to mitigate cross-site scripting (XSS) vulnerabilities. It is recommended to use alternative methods, such as carefully constructing URLs or relying on server-side frameworks that handle URL generation securely.

Reviewer Note : Reviewers should verify that the PHP_SELF variable is not directly used in generating URLs or output without proper sanitization and encoding. They should also ensure that other security measures, such as input validation and output escaping, are implemented to prevent XSS vulnerabilities in the codebase.

---

11.Rule Title : SELECT [*] FROM [anytable] WHERE

---

Rule Description : Detects instances of SELECT statements in SQL queries that retrieve data from a table with a WHERE clause.

Issue Description : If this rule matches, it indicates the potential vulnerability of SQL injection. Attackers can exploit this vulnerability to manipulate the WHERE clause and perform unauthorized data retrieval or modification.

Developer Note : Developers should ensure that SQL queries using SELECT statements with a WHERE clause are properly parameterized or sanitized to prevent SQL injection attacks.

Reviewer Note : Reviewers should verify the presence of secure coding practices, such as parameterized queries or proper input validation and sanitization, to mitigate the risk of SQL injection vulnerabilities in SELECT statements with a WHERE clause.

---

12.Rule Title : SELECT ORDERBY

---

Rule Description : Detects instances of SELECT statements in SQL queries that include an ORDER BY clause.

Issue Description : If this rule matches, it indicates the potential vulnerability of SQL injection. Attackers can exploit this vulnerability to manipulate the ORDER BY clause and potentially alter the query results or introduce additional malicious functionality.

Developer Note : Developers should ensure that SQL queries using SELECT statements with an ORDER BY clause are properly parameterized or sanitized to prevent SQL injection attacks.

Reviewer Note : Reviewers should verify the presence of secure coding practices, such as parameterized queries or proper input validation and sanitization, specifically for SELECT statements that include an ORDER BY clause, to mitigate the risk of SQL injection vulnerabilities.

---